Security

How we protect your information

You trust us with exactly the kind of information you're trying to protect. These are the measures built into the service.

Your data

• Profile details (names, emails, phone numbers, locations) and discovered listing links are encrypted at rest using authenticated encryption. The key is stored on the server outside the database, so a database copy alone cannot be read.
• We collect only what's needed and never ask for identity documents by default.
• Notification emails never include your personal details; they link to your signed-in dashboard.
• Reports exclude personal values unless you choose to include listing links.
• You can export or permanently delete your data from your account settings.

Your account

• Passwords are stored as strong one-way hashes; we can never see them.
• Optional two-factor authentication with any standard authenticator app, plus single-use recovery codes.
• Sign-in attempts are rate-limited and sessions expire after inactivity. You can sign out all other sessions at any time.
• All traffic uses HTTPS with strict transport security.

Responsible automation

• Automated checks run only against sources an administrator has verified, and only through official APIs, authorised search providers or permitted page checks.
• We honour robots.txt for page re-checks, rate-limit every source, and never bypass CAPTCHAs, logins or identity verification. When a site requires a human step, we pause and ask you.
• Our servers only contact a fixed allow-list of verified domains.

Internally

• Staff access is role-based: support staff can't see the details of your removal requests, and every administrative action is logged.
• Logs are kept for a limited period and do not contain passwords, tokens or your profile details.

Reporting a vulnerability

If you believe you've found a security issue, please email joshualugu17@gmail.com with details. Please don't access other people's data while testing.